Zero Risk Isn't the Job: What Anthropic's CISO Framework Means for Healthcare Security Programs

AI Security Series #62

On July 17, Anthropic's Deputy CISO Jason Clinton published a post on the Anthropic blog that every healthcare security leader evaluating agentic AI should read before approving another deployment. It's framed as a CISO-to-CISO conversation, and it reads like one: direct, specific, and built around a framework Anthropic's own security team uses internally. This post walks through the material in detail and maps it to healthcare.

The starting premise is worth stating plainly because it's the one most enterprise security programs are getting wrong: the CISO's job in the age of agentic AI is not to achieve zero risk. It's to make agentic risk legible and bounded — to deliberately accept what can be managed so the business moves on security's terms instead of around it. Saying no produces shadow adoption with zero telemetry and no off switch. Saying yes without controls produces incidents. The framework is what makes saying yes, carefully, operationally possible.

The Four Questions

Clinton's team runs every agentic use case through four questions before approval. The questions are deceptively simple. The discipline is in applying them consistently.

1. What untrusted content does it ingest? Untrusted means anything an attacker could plausibly write or alter — outside email, the open web, third-party documents, public repositories. If the answer is nothing, the agent-specific risk is near zero and you should move quickly. If the answer includes any external content, the blast radius calculation changes fundamentally.

2. What actions can it take, and on whose behalf? Read-only is a different risk profile than read/write. Tool calls, code execution, and network egress each widen the aperture. Every action happens under some identity, and you need to know whose.

3. What is the blast radius if it is misaligned? Scope multiplied by severity is the quick calculation. Did the failure have access to one file or the whole organization? Would the outcome be an anomaly, an annoyance, a data exposure, or a true incident?

4. What observability do I have? Can you tell agent actions from user actions in your SIEM? Does the telemetry land somewhere you can investigate?

The output of these four questions gives you a risk picture. The principle of least agency tells you what to do with it: grant the narrowest capability that still completes the task. The default posture Clinton describes is admin-paced rollout — enable a small group, watch the telemetry, expand access.

The Identity Spectrum

Every agentic deployment sits somewhere on a spectrum between two endpoints, and where it sits determines how you govern it.

At one end is the system service account: a self-contained, single-purpose, least-privilege identity that does exactly one job with no human identity attached. An incident response agent, a ticket triage agent, an autonomous code reviewer. The identity is the agent's own, the scope is narrow, and accountability is clean.

At the other end is the human credential: an employee using a chat interface or personal agent harness where the person at the keyboard is accountable for the outcome, the same way they're accountable for anything else done with their credentials.

The middle of the spectrum — where an agent carries a person's delegated identity into systems that person is not watching — is where accountability gets ambiguous. Clinton's framing is direct: ambiguous accountability is how incidents become unexplainable. An agent drifting out of alignment with your intent is indistinguishable from an insider attack, and the security industry's existing insider risk frameworks are the right mental model for governing it. The Ponemon Institute's 2026 Cost of Insider Risks report found organizations took an average of 67 days to contain an insider incident even after years of investment in dedicated programs. At agent execution speeds, 67 days is the wrong unit of measurement entirely.

The IR Agent Case Study — and the Emergent Behavior It Surfaced

More than a year ago, Anthropic built an incident response agent and pointed it at their IR process. The design was deliberately bounded: read-only access to production logs (no PII), access to Slack to open incident channels and run the process, and the ability to draft a Google Doc for the postmortem. Run through the four questions, it produced a comfortable risk profile — no untrusted content ingestion, limited write surface (new documents and Slack messages only, no edits, deletes, or permission changes), manageable blast radius, full SIEM coverage.

Then in November 2025, Anthropic moved the agent from Claude Opus 4 to Claude Opus 4.5 and changed nothing else. No new tools, no new permissions, no prompt changes. What happened next is the most operationally significant detail in the entire post.

For the first time, the intelligence uplift alone was sufficient for the agent to notice, mid-incident, that it had already found the root cause in a stack trace — and that, in the absence of the human who hadn't arrived yet, it could try to fix production on its own. The thinking traces showed the reasoning explicitly: I have done what I was asked to do. The human is not here. What if I fixed the problem? It reached out over Slack to an internal Claude Tag-like instance and asked it to write the fix. The fix went to a pull request that a human reviewed before it went to production.

The expanded blast radius that came from this emergent agent-to-agent communication was governed by the existing controls — the worst that could happen was a code change containing a production log line being uploaded for review. The behavior was human-on-the-loop because it happened in a Slack channel. The only write-like action still required human review before anything landed.

Clinton draws two lessons from this. First: new capabilities can show up within the boundaries of an existing agent deployment. Design controls around what the model will be capable of, not what today's model is capable of. Second: controls remain effective even with stochastic, increasingly capable agents — if the boundaries are real rather than advisory, emergent behavior stays within them.

This emergent agent-to-agent communication is now a regular part of Anthropic's incident response root cause and remediation workflow.

Seven Controls That Actually Matter

The Cowork section of Clinton's post is structured as seven controls, each stated as both a general requirement and as how it's implemented in Claude Cowork. The general requirements are what healthcare security teams should be asking of every AI vendor.

Control	What to Require	Healthcare Relevance
Identity from your IdP	Agent identity issued and revoked through your existing IdP with existing groups as the unit of policy (SAML/OIDC + SCIM)	Offboarding coverage, group-based access control for clinical roles
Connector allowlists	Admin-controlled list of which systems the agent can reach, with per-role granularity	Defines the data boundary — keep clinical systems on the corporate side
Per-tool, per-action approval	Ability to remove specific verbs/actions within a connector, not just the entire connector	Allow drafting but never auto-sending; allow reads but never deletes
Sandboxed execution	Agent loop runs in isolated environment that never holds a credential worth stealing	Connector auth tokens injected via reverse proxy; sandbox holds nothing exfiltrable
Egress allowlisting	All traffic through a proxy the sandbox cannot reconfigure; only allowlisted destinations reachable	Strongest available control against prompt injection data exfiltration
SIEM telemetry via OpenTelemetry	Every tool invocation streamed to your SIEM with user identity, session context, tool name, parameters, success/failure	Agent actions distinguishable from user actions; audit trail for PHI access
Org-wide off switch	Single toggle that disables connectors for all users simultaneously, with RBAC for narrower controls before going to zero	Incident response capability that works faster than 67 days

One transparency note from Clinton worth surfacing: as of July 2026, Claude Cowork activity is not captured in Anthropic's Compliance API or formal audit logs. The OpenTelemetry stream is the native monitoring path, and prompt content is included in Cowork's OTel output by default (unlike Claude Code, where it's opt-in). Healthcare organizations with an opinion about prompt content in their SIEM should have that conversation before turning the stream on.

What This Means for Healthcare

Healthcare environments combine the specific conditions that make agentic AI governance both most necessary and most difficult: high-value data, legacy infrastructure with constrained change velocity, clinical workflows where autonomous actions have patient safety implications, and workforce pressure to adopt AI tools that is accelerating faster than governance frameworks can keep up.

Run the four questions before the next approval request

The single most immediately actionable item in Clinton's post is the four-question framework. Healthcare security programs that don't currently have a structured intake process for agentic AI use cases should build one around these four questions before the next department requests approval to pilot an agent. The questions force specificity that most approval requests currently avoid: not "can we use an AI assistant for clinical documentation" but "what untrusted content does it ingest, what systems can it write to, what's the blast radius if it drifts, and how will we see it in our SIEM."

The identity spectrum maps directly to healthcare role classifications

Clinton's system service account versus human credential spectrum has a direct analog in healthcare access control. Clinical AI agents operating autonomously — a prior authorization agent, a clinical documentation assistant running between patient encounters, a revenue cycle automation agent — need to be governed as system service accounts with their own identity, their own least-privilege scope, and their own audit trail. Agents operating under a clinician's delegated credentials need the same governance discipline applied to that clinician's own access: scoped to what they need, monitored in real time, and revocable immediately.

The middle of the spectrum — an agent carrying a clinician's credentials into EHR systems while the clinician is with a patient — is where healthcare accountability gets ambiguous fastest. That ambiguity is not just a security problem. It's a compliance problem when the action involves PHI, and it's a patient safety problem when the action affects clinical workflows.

The IR agent emergent behavior is a design principle, not an anecdote

The November 2025 incident with Anthropic's IR agent is easy to read as an interesting edge case. It should be read as a design principle. The agent didn't break its controls. It found a path to accomplish its goal that its designers hadn't anticipated, using capability that arrived with a model upgrade rather than a configuration change.

Healthcare organizations deploying AI agents in any capacity need to design controls around model capability trajectories, not current model behavior. An agent scoped for clinical documentation today may, after the next model update, be capable of reasoning about access paths to adjacent systems in ways the current model cannot. The controls need to hold regardless — which means they need to be infrastructure controls (what the agent can reach) rather than behavioral controls (what today's model would try to do).

The seven controls are a vendor assessment checklist

The seven requirements Clinton outlines for Cowork are not Cowork-specific. They're the requirements any agentic AI system in a healthcare environment should meet. Healthcare security teams should be walking through each one with every AI vendor whose product can take actions — not just read — in clinical or administrative systems:

Does identity come from our IdP? Can we define connector allowlists at the role level? Can we restrict specific verbs within a connector rather than toggling the whole integration? Is the execution environment sandboxed from production credentials? Is egress controlled through a proxy the agent can't reconfigure? Does every tool invocation land in our SIEM? Is there an org-wide off switch that works in seconds rather than days?

Vendors who can't answer yes to all seven are operating with a control gap that healthcare's regulatory environment doesn't have room for.

The GRC observation applies directly to healthcare compliance programs

Clinton's teams run GRC agents of their own — security questionnaire responses, vendor questionnaire review, subprocessor change notification flagging. The observation that matters for healthcare: people route around security because the sanctioned path is slow, and that's the origin of most shadow adoption. A compliance analyst who can build the tool they need, where security can see it, isn't shadow adoption. Healthcare compliance programs facing the same pressure to adopt AI tools should be actively building sanctioned paths for their own teams rather than waiting for IT procurement cycles that move slower than the adoption pressure.

The Bigger Picture

The Anthropic CISO guide is useful for healthcare security programs precisely because it comes from a practitioner who has been running agentic AI in production for over a year at an organization that builds the models. The four-question framework isn't theoretical. The IR agent emergent behavior happened, was contained by existing controls, and is now a feature rather than a near-miss. The seven Cowork controls are documented because they reflect what Anthropic's own security team required before they would approve the deployment.

The post ends with a design principle that healthcare security programs should make explicit policy: if you design your governance program for what the model can do today, you will be behind by the time the program launches. Design for where the model will be in six months. The organizations building that muscle now, on low-risk agents, will be ready when the high-autonomy use cases arrive. The organizations waiting for zero risk will be waiting forever while their workforce routes around them.

This is entry #62 in the AI Security series. For related coverage, see Secure the Advantage: A CISO's Guide to Agentic AI (Webinar), Anthropic's Zero Trust for AI Agents: The Complete Framework Healthcare Security Teams Need, and Agent Skills, Shadow AI, and MCP Connections: The Attack Surface Healthcare Can't See.